Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fef349a8c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219
WARNING: CPU: 0 PID: 2902 at net/mac80211/tx.c:4134 __ieee80211_csa_update_counter net/mac80211/tx.c:4134 [inline]
WARNING: CPU: 0 PID: 2902 at net/mac80211/tx.c:4134 __ieee80211_csa_update_counter net/mac80211/tx.c:4129 [inline]
WARNING: CPU: 0 PID: 2902 at net/mac80211/tx.c:4134 __ieee80211_beacon_get+0x1678/0x1a30 net/mac80211/tx.c:4327
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 00007fef349a8ca0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
Kernel panic - not syncing: panic_on_warn set ...

R13: 00007ffdde4dd62f R14: 00007fef349a99c0 R15: 000000000119bf8c
CPU: 0 PID: 2902 Comm: kworker/u4:5 Not tainted 4.19.164-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 panic+0x26a/0x50e kernel/panic.c:186
 __warn.cold+0x20/0x61 kernel/panic.c:541
 report_bug+0x262/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:__ieee80211_csa_update_counter net/mac80211/tx.c:4134 [inline]
RIP: 0010:__ieee80211_csa_update_counter net/mac80211/tx.c:4129 [inline]
RIP: 0010:__ieee80211_beacon_get+0x1678/0x1a30 net/mac80211/tx.c:4327
Code: 85 70 03 00 00 41 0f b6 45 24 31 ff 44 8d 60 ff 45 88 65 24 44 89 e6 e8 36 7f a2 f9 45 84 e4 0f 85 4f f5 ff ff e8 f8 7d a2 f9 <0f> 0b e9 43 f5 ff ff e8 ec 7d a2 f9 e8 47 4d 90 f9 31 ff 41 89 c4
RSP: 0018:ffff8880ba007c08 EFLAGS: 00010206
RAX: ffff8880abc660c0 RBX: ffff88809c2c2310 RCX: ffffffff87c252ea
RDX: 0000000000000100 RSI: ffffffff87c252f8 RDI: 0000000000000001
RBP: ffff8880482b1ba0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880a2eee840 R14: 0000000000000000 R15: ffff8880ba007d50
 ieee80211_beacon_get_tim+0x88/0x890 net/mac80211/tx.c:4443
 ieee80211_beacon_get include/net/mac80211.h:4484 [inline]
 mac80211_hwsim_beacon_tx+0xff/0x680 drivers/net/wireless/mac80211_hwsim.c:1577
 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614
 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650
 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615
 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601
 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522
 __do_softirq+0x26c/0x9a0 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:545 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:__read_once_size include/linux/compiler.h:207 [inline]
RIP: 0010:csd_lock_wait kernel/smp.c:108 [inline]
RIP: 0010:smp_call_function_single+0x1db/0x420 kernel/smp.c:302
Code: 00 e8 a9 17 0a 00 48 8b 4c 24 08 48 8b 54 24 10 48 8d 74 24 40 8b 7c 24 1c e8 a1 f9 ff ff 41 89 c5 eb 07 e8 87 17 0a 00 f3 90 <44> 8b 64 24 58 31 ff 41 83 e4 01 44 89 e6 e8 e2 18 0a 00 45 85 e4
RSP: 0018:ffff8880abc7ed20 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: ffff8880abc660c0 RBX: 1ffff1101578fda8 RCX: ffffffff815ab97e
RDX: 0000000000000000 RSI: ffffffff815ab969 RDI: 0000000000000005
RBP: ffff8880abc7edf8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000002
 smp_call_function_many+0x743/0x8d0 kernel/smp.c:434
 flush_tlb_others arch/x86/include/asm/paravirt.h:309 [inline]
 flush_tlb_mm_range+0x179/0x320 arch/x86/mm/tlb.c:728
 flush_tlb_page arch/x86/include/asm/tlbflush.h:576 [inline]
 ptep_clear_flush+0x123/0x160 mm/pgtable-generic.c:87
 page_mkclean_one+0x2b1/0x5b0 mm/rmap.c:915
 rmap_walk_file+0x4fe/0xc10 mm/rmap.c:1887
 rmap_walk+0x105/0x190 mm/rmap.c:1905
 page_mkclean+0x20f/0x2b0 mm/rmap.c:984
 clear_page_dirty_for_io+0x305/0xee0 mm/page-writeback.c:2687
 mpage_submit_page+0x80/0x250 fs/ext4/inode.c:2216
 mpage_process_page_bufs+0x534/0x630 fs/ext4/inode.c:2346
 mpage_prepare_extent_to_map+0x9a2/0xf10 fs/ext4/inode.c:2708
 ext4_writepages+0x111d/0x37f0 fs/ext4/inode.c:2836
 do_writepages+0xe5/0x290 mm/page-writeback.c:2344
 __writeback_single_inode+0x113/0x1340 fs/fs-writeback.c:1382
 writeback_sb_inodes+0x537/0xef0 fs/fs-writeback.c:1646
 wb_writeback+0x28d/0xcc0 fs/fs-writeback.c:1819
 wb_do_writeback fs/fs-writeback.c:1964 [inline]
 wb_workfn+0x2f0/0x12f0 fs/fs-writeback.c:2005
 process_one_work+0x864/0x1570 kernel/workqueue.c:2155
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Kernel Offset: disabled
Rebooting in 86400 seconds..